Device lost or seized

In the first hour

If it’s a colleague’s phone or laptop, do these with them, from another device, in order.

1. If someone was detained, start with them. Call a lawyer and the people who support them, and agree who does what, so nobody acts alone or twice. Talk the steps below through with the lawyer, above all before you erase anything.
2. Sign the device out of every account. Start with email, then cloud storage, messaging apps, social media and any banking or mobile money apps. Most accounts list the devices signed in to them on a security page: remove the missing one there. If it was a laptop, also remove it from WhatsApp and Signal on your phone, under Linked devices.
3. Change the passwords of every account it held, starting with email. Passwords saved on the device or in its browser may be readable. If the phone was where your sign-in codes arrived, use your backup codes to get in. Change any of those passwords you also use somewhere else.
4. Lock it remotely, and hold off erasing it. Mark it as lost through the maker’s service (the links are below). A lost or stolen device can be erased once your accounts are safe. If police or other officials took it, don’t erase it without legal advice.
5. Call your mobile operator and your bank. If it was a phone, ask the operator to block the SIM and give you a new one with the same number, so codes sent by text stop reaching whoever has it. Tell the bank if banking or mobile money apps were on it.

Locking and erasing

Each maker has a service that finds, locks and erases its devices: Find My for an iPhone or iPad, Find Hub for Android and Find my device for Windows. Marking a device as lost locks it with its passcode and can show a phone number on its screen for whoever finds it (Apple; Google). These services only work if they were switched on before the device went missing (Apple; Microsoft).

If the missing iPhone is the one that gets your sign-in codes, you can still sign in to Find Devices on iCloud.com without a code. Apple never contacts people to say a lost iPhone has been found, so don’t share the passcode or any code with someone who says it has (Apple).

Chat apps on a missing phone need the new SIM from your mobile operator. Put it in another phone and set WhatsApp up again with the same number: that signs the missing phone out (SIIRF; WhatsApp). In Telegram, end the old phone’s session from another device under Settings, then Devices (Telegram). Signal works the same way once you register it on another phone: messages stop reaching the old one, but the old messages stay on it (Signal).

Erasing deletes everything on the device, and an erased Android phone drops out of Find Hub, so you can’t track it any more (Google). When to do it depends on who has it:

• Lost or stolen: erase it once you’ve signed it out of your accounts and changed the passwords.
• Taken by police or other officials: get legal advice before you erase it, and as a rule don’t erase it after an arrest (SIIRF). Access Now’s helpline says, “we do not generally advise wiping after an arrest” (Access Now). If the person was made to unlock it, “data suddenly disappearing from the device might make the detaining authorities more suspicious”, and in some countries wiping it from afar can count as destroying evidence (Digital First Aid Kit).

When someone is being held, talk every change to their accounts through with the lawyer first, including new passwords. The authorities can read changes as destroying evidence, and if the person gave access to an account, finding it changed or gone can make things worse for them (Digital First Aid Kit).

If you’re coordinating the response, SIIRF’s Lost & Seized Devices playbook helps you judge how serious it is and lists the evidence to keep.

If it comes back

Samuel directs a legal aid organisation in Addis Ababa. On his way home from a regional meeting, officials at a border took his laptop into another room for an hour, then handed it back. He wanted to start working on it that evening. Instead, his team left it switched off and asked a helpline to check it first.

That’s the safe way round. Assume that whoever had the device has seen what was on it, and may have copied it or put something on it. Don’t use it until an expert has checked it, or until it’s been fully reset (SIIRF; Security in a Box):

• A check first if you want to know what happened. A forensic check looks for traces of harmful software, and a reset wipes those traces, so don’t reset before the check (SIIRF). Ask a helpline, such as Access Now’s Digital Security Helpline, which helps when a computer may be infected.
• A reset or a new device if you don’t need to know. Even an expert can’t always prove a device is clean, so replacing it is sometimes the only safe choice (Security in a Box). Deleting data safely explains how to do a factory reset properly.

Until then, keep an eye on the accounts from another device: each account’s list of signed-in devices shows anything new (Google). Travel and border crossings covers checking a device for tampering after it has been out of sight.

Tell people

A missing device holds other people’s details and conversations, not just its owner’s. Warn the people whose details or messages were on it, so they can protect themselves (SIIRF). Tell them in person, or on a channel the device isn’t signed in to.

• Group chats: if the device was in your groups, start new ones without its account, so it stops receiving your messages (SIIRF). Give each group more than one admin (Digital First Aid Kit).
• After an arrest: agree who tells whom, and how, before anyone starts. A message warning someone that their details were on a seized phone can itself be intercepted and used to link them to the person held, so meet in person where you can (Digital First Aid Kit).
• The police: only if you need a report, for an insurance claim for example, and it’s safe to go to them (SIIRF).

Write it down

As you go, or before the day is out, note (SIIRF):

• when and where the device went missing, and who took it
• for a seizure, the names, badge numbers and papers you saw, and what was said
• which accounts were signed in on it, and what was stored on it
• what you did, when you did it and who did it: sessions signed out, passwords changed, the device locked or erased

Then, for a month, look at each account’s recent activity once a week (Digital First Aid Kit). If something shows up that nobody recognises, go to Account taken over. Keep your notes with your team’s notes on past incidents. Your incident response plan says where those are kept, and SIIRF’s Incident Log has a format you can copy.

Look after the person

Losing a phone is upsetting, and having one taken is frightening. People often blame themselves for losing it. Tell them plainly that nobody is in trouble, and share the work: make the calls and sign the accounts out with them, not around them.

After an arrest, the people around the person held are frightened too. A small team that coordinates support, care and any campaigning keeps efforts from clashing, and should involve the family as far as they want to be involved (Digital First Aid Kit). That includes you:

Taking care of the detainee as well as of the digital impacts of this detention might be exhausting and challenging. Try to find others to support you and coordinate your actions with the community involved.

Peter Steudtner and Shakeeb Al-Jabri, Digital First Aid Kit

When the person is released, hand their accounts back: tell them which passwords changed and return control to them (Digital First Aid Kit). Check in again over the following weeks; Well-being and care has more on what helps.

Close the way in

When things are calm, make the next lost or taken device harder to open (SIIRF):

• Lock and encrypt every device: a passcode of at least six digits, or a passphrase, and full-disk encryption. Phones and laptops shows how.
• Switch on find, lock and erase before anyone needs them.
• Keep passwords in a password manager, not saved in the browser, and the backup codes somewhere other than the phone.
• Carry less: keep as little sensitive information on devices as you can, with backups of the rest, and delete what you no longer need. In sensitive chats, use disappearing messages.
• Keep a list of which accounts are signed in on which devices, so the first hour starts from the list.
• Plan for risky trips and events: take a clean device that holds only what you need, and switch it off at the riskiest moments, since a phone that’s off is harder to unlock than one that’s only locked. Travel and border crossings has the details.

If a device keeps behaving strangely after it came back, see Spyware and surveillance.

Teach it to your team

Try this at your next team meeting. It takes about 30 minutes, and everyone needs their phone.

• Prepare: have the scenario below ready to read out, and find the “lost device” page for the phones your team uses from the links above.
• Exercise: read out this scenario: a colleague’s laptop is stolen on the bus home. It’s signed in to the organisation’s email and shared drive, and holds a spreadsheet of the people you work with. What do you do in the first hour? Let the room answer before you do. Then everyone checks that find, lock and erase is switched on for their phone, and writes down which accounts it’s signed in to.
• Three questions: Which two things do you do first, from another device? When shouldn’t you erase a missing device? If it comes back, why not start using it again straight away?
• Afterwards: offer one-to-one help to anyone who couldn’t switch the setting on, and answer questions in the team chat. For a longer session, play SIIRF’s Chips Down: level 1 has a stolen laptop, and level 2 a phone kept by police.